General
-
Target
3a369041440eec907acb1b854150c12c.exe
-
Size
778KB
-
Sample
230612-tpmzgada34
-
MD5
3a369041440eec907acb1b854150c12c
-
SHA1
f6d8aefb071b76daa9f0d2258c9d09a935dfd81e
-
SHA256
da11108b7fb14023a20b5d1316e9a5853690b80e079e77a1879ea9a446ef392a
-
SHA512
a928a70995532136e549986a0da3fa92d973ad0a784e6a76ed8da7571de4768cdc75ea7b0f3a5b4045eae93eb73a637a55bc38c34e563149c8a60200ed075105
-
SSDEEP
12288:cMrvy90QTR7+xBhqWkRH4n9Q5Cac1ZER65LomG1wCa2RbHTuIbBcvQFH:zy7g3Q9YGC/Z1LoWCLnuItcvyH
Static task
static1
Behavioral task
behavioral1
Sample
3a369041440eec907acb1b854150c12c.exe
Resource
win7-20230220-en
Malware Config
Extracted
redline
boris
83.97.73.129:19068
-
auth_value
205e4fccc0f8c7da1d56fb1da4ac5e6a
Extracted
redline
moro
83.97.73.129:19068
-
auth_value
24d4f20def584fcfb9067c13ead26e63
Extracted
amadey
3.83
77.91.68.30/music/rock/index.php
Extracted
redline
doro
83.97.73.129:19068
-
auth_value
03f411441fb3fa233179c2cc8ffbce27
Targets
-
-
Target
3a369041440eec907acb1b854150c12c.exe
-
Size
778KB
-
MD5
3a369041440eec907acb1b854150c12c
-
SHA1
f6d8aefb071b76daa9f0d2258c9d09a935dfd81e
-
SHA256
da11108b7fb14023a20b5d1316e9a5853690b80e079e77a1879ea9a446ef392a
-
SHA512
a928a70995532136e549986a0da3fa92d973ad0a784e6a76ed8da7571de4768cdc75ea7b0f3a5b4045eae93eb73a637a55bc38c34e563149c8a60200ed075105
-
SSDEEP
12288:cMrvy90QTR7+xBhqWkRH4n9Q5Cac1ZER65LomG1wCa2RbHTuIbBcvQFH:zy7g3Q9YGC/Z1LoWCLnuItcvyH
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-